Log in Start free

Vulnerability · Published Oct 7, 2026 · Assigned by redhat

CVE-2026-103868Pulp-container: registry credentials are reused across remotes in a worker

Medium 6.5

In plain English

A medium-severity security flaw in Red Hat Ansible Automation Platform 2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 86.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username, password, or bearer token stored for a different remote, and can reuse that credential at the upstream registry. Content stored in Pulp is not changed, and the service is not stopped.

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Ansible Automation Platform 2 see references
Red Hat Red Hat Satellite 6 see references
Red Hat Red Hat Satellite 6 see references
Red Hat Red Hat Update Infrastructure 4 for Cloud Providers see references
Red Hat Red Hat Update Infrastructure 4 for Cloud Providers see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Update Infrastructure 5 see references
Red Hat Red Hat Update Infrastructure 5 see references

Weakness: CWE-488 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References